contrib/unbound/validator/val_utils.c

   1 /*
   2  * validator/val_utils.c - validator utility functions.
   3  *
   4  * Copyright (c) 2007, NLnet Labs. All rights reserved.
   5  *
   6  * This software is open source.
   7  *
   8  * Redistribution and use in source and binary forms, with or without
   9  * modification, are permitted provided that the following conditions
  10  * are met:
  11  *
  12  * Redistributions of source code must retain the above copyright notice,
  13  * this list of conditions and the following disclaimer.
  14  *
  15  * Redistributions in binary form must reproduce the above copyright notice,
  16  * this list of conditions and the following disclaimer in the documentation
  17  * and/or other materials provided with the distribution.
  18  *
  19  * Neither the name of the NLNET LABS nor the names of its contributors may
  20  * be used to endorse or promote products derived from this software without
  21  * specific prior written permission.
  22  *
  23  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  24  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  25  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
  26  * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
  27  * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  28  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
  29  * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
  30  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
  31  * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
  32  * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
  33  * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  34  */
  35
  36 /**
  37  * \file
  38  *
  39  * This file contains helper functions for the validator module.
  40  */
  41 #include "config.h"
  42 #include "validator/val_utils.h"
  43 #include "validator/validator.h"
  44 #include "validator/val_kentry.h"
  45 #include "validator/val_sigcrypt.h"
  46 #include "validator/val_anchor.h"
  47 #include "validator/val_nsec.h"
  48 #include "validator/val_neg.h"
  49 #include "services/cache/rrset.h"
  50 #include "services/cache/dns.h"
  51 #include "util/data/msgreply.h"
  52 #include "util/data/packed_rrset.h"
  53 #include "util/data/dname.h"
  54 #include "util/net_help.h"
  55 #include "util/module.h"
  56 #include "util/regional.h"
  57 #include "util/config_file.h"
  58 #include "sldns/wire2str.h"
  59 #include "sldns/parseutil.h"
  60
  61 enum val_classification
  62 val_classify_response(uint16_t query_flags, struct query_info* origqinf,
  63         struct query_info* qinf, struct reply_info* rep, size_t skip)
  64 {
  65         int rcode = (int)FLAGS_GET_RCODE(rep->flags);
  66         size_t i;
  67
  68         /* Normal Name Error's are easy to detect -- but don't mistake a CNAME
  69          * chain ending in NXDOMAIN. */
  70         if(rcode == LDNS_RCODE_NXDOMAIN && rep->an_numrrsets == 0)
  71                 return VAL_CLASS_NAMEERROR;
  72
  73         /* check for referral: nonRD query and it looks like a nodata */
  74         if(!(query_flags&BIT_RD) && rep->an_numrrsets == 0 &&
  75                 rcode == LDNS_RCODE_NOERROR) {
  76                 /* SOA record in auth indicates it is NODATA instead.
  77                  * All validation requiring NODATA messages have SOA in
  78                  * authority section. */
  79                 /* uses fact that answer section is empty */
  80                 int saw_ns = 0;
  81                 for(i=0; i<rep->ns_numrrsets; i++) {
  82                         if(ntohs(rep->rrsets[i]->rk.type) == LDNS_RR_TYPE_SOA)
  83                                 return VAL_CLASS_NODATA;
  84                         if(ntohs(rep->rrsets[i]->rk.type) == LDNS_RR_TYPE_DS)
  85                                 return VAL_CLASS_REFERRAL;
  86                         if(ntohs(rep->rrsets[i]->rk.type) == LDNS_RR_TYPE_NS)
  87                                 saw_ns = 1;
  88                 }
  89                 return saw_ns?VAL_CLASS_REFERRAL:VAL_CLASS_NODATA;
  90         }
  91         /* root referral where NS set is in the answer section */
  92         if(!(query_flags&BIT_RD) && rep->ns_numrrsets == 0 &&
  93                 rep->an_numrrsets == 1 && rcode == LDNS_RCODE_NOERROR &&
  94                 ntohs(rep->rrsets[0]->rk.type) == LDNS_RR_TYPE_NS &&
  95                 query_dname_compare(rep->rrsets[0]->rk.dname,
  96                         origqinf->qname) != 0)
  97                 return VAL_CLASS_REFERRAL;
  98
  99         /* dump bad messages */
 100         if(rcode != LDNS_RCODE_NOERROR && rcode != LDNS_RCODE_NXDOMAIN)
 101                 return VAL_CLASS_UNKNOWN;
 102         /* next check if the skip into the answer section shows no answer */
 103         if(skip>0 && rep->an_numrrsets <= skip)
 104                 return VAL_CLASS_CNAMENOANSWER;
 105
 106         /* Next is NODATA */
 107         if(rcode == LDNS_RCODE_NOERROR && rep->an_numrrsets == 0)
 108                 return VAL_CLASS_NODATA;
 109
 110         /* We distinguish between CNAME response and other positive/negative
 111          * responses because CNAME answers require extra processing. */
 112
 113         /* We distinguish between ANY and CNAME or POSITIVE because
 114          * ANY responses are validated differently. */
 115         if(rcode == LDNS_RCODE_NOERROR && qinf->qtype == LDNS_RR_TYPE_ANY)
 116                 return VAL_CLASS_ANY;
 117
 118         /* Note that DNAMEs will be ignored here, unless qtype=DNAME. Unless
 119          * qtype=CNAME, this will yield a CNAME response. */
 120         for(i=skip; i<rep->an_numrrsets; i++) {
 121                 if(rcode == LDNS_RCODE_NOERROR &&
 122                         ntohs(rep->rrsets[i]->rk.type) == qinf->qtype)
 123                         return VAL_CLASS_POSITIVE;
 124                 if(ntohs(rep->rrsets[i]->rk.type) == LDNS_RR_TYPE_CNAME)
 125                         return VAL_CLASS_CNAME;
 126         }
 127         log_dns_msg("validator: error. failed to classify response message: ",
 128                 qinf, rep);
 129         return VAL_CLASS_UNKNOWN;
 130 }
 131
 132 /** Get signer name from RRSIG */
 133 static void
 134 rrsig_get_signer(uint8_t* data, size_t len, uint8_t** sname, size_t* slen)
 135 {
 136         /* RRSIG rdata is not allowed to be compressed, it is stored
 137          * uncompressed in memory as well, so return a ptr to the name */
 138         if(len < 21) {
 139                 /* too short RRSig:
 140                  * short, byte, byte, long, long, long, short, "." is
 141                  * 2    1       1       4       4  4    2       1 = 19
 142                  *                      and a skip of 18 bytes to the name.
 143                  * +2 for the rdatalen is 21 bytes len for root label */
 144                 *sname = NULL;
 145                 *slen = 0;
 146                 return;
 147         }
 148         data += 20; /* skip the fixed size bits */
 149         len -= 20;
 150         *slen = dname_valid(data, len);
 151         if(!*slen) {
 152                 /* bad dname in this rrsig. */
 153                 *sname = NULL;
 154                 return;
 155         }
 156         *sname = data;
 157 }
 158
 159 void
 160 val_find_rrset_signer(struct ub_packed_rrset_key* rrset, uint8_t** sname,
 161         size_t* slen)
 162 {
 163         struct packed_rrset_data* d = (struct packed_rrset_data*)
 164                 rrset->entry.data;
 165         /* return signer for first signature, or NULL */
 166         if(d->rrsig_count == 0) {
 167                 *sname = NULL;
 168                 *slen = 0;
 169                 return;
 170         }
 171         /* get rrsig signer name out of the signature */
 172         rrsig_get_signer(d->rr_data[d->count], d->rr_len[d->count],
 173                 sname, slen);
 174 }
 175
 176 /**
 177  * Find best signer name in this set of rrsigs.
 178  * @param rrset: which rrsigs to look through.
 179  * @param qinf: the query name that needs validation.
 180  * @param signer_name: the best signer_name. Updated if a better one is found.
 181  * @param signer_len: length of signer name.
 182  * @param matchcount: count of current best name (starts at 0 for no match).
 183  *      Updated if match is improved.
 184  */
 185 static void
 186 val_find_best_signer(struct ub_packed_rrset_key* rrset,
 187         struct query_info* qinf, uint8_t** signer_name, size_t* signer_len,
 188         int* matchcount)
 189 {
 190         struct packed_rrset_data* d = (struct packed_rrset_data*)
 191                 rrset->entry.data;
 192         uint8_t* sign;
 193         size_t i;
 194         int m;
 195         for(i=d->count; i<d->count+d->rrsig_count; i++) {
 196                 sign = d->rr_data[i]+2+18;
 197                 /* look at signatures that are valid (long enough),
 198                  * and have a signer name that is a superdomain of qname,
 199                  * and then check the number of labels in the shared topdomain
 200                  * improve the match if possible */
 201                 if(d->rr_len[i] > 2+19 && /* rdata, sig + root label*/
 202                         dname_subdomain_c(qinf->qname, sign)) {
 203                         (void)dname_lab_cmp(qinf->qname,
 204                                 dname_count_labels(qinf->qname),
 205                                 sign, dname_count_labels(sign), &m);
 206                         if(m > *matchcount) {
 207                                 *matchcount = m;
 208                                 *signer_name = sign;
 209                                 (void)dname_count_size_labels(*signer_name,
 210                                         signer_len);
 211                         }
 212                 }
 213         }
 214 }
 215
 216 void
 217 val_find_signer(enum val_classification subtype, struct query_info* qinf,
 218         struct reply_info* rep, size_t skip, uint8_t** signer_name,
 219         size_t* signer_len)
 220 {
 221         size_t i;
 222
 223         if(subtype == VAL_CLASS_POSITIVE) {
 224                 /* check for the answer rrset */
 225                 for(i=skip; i<rep->an_numrrsets; i++) {
 226                         if(query_dname_compare(qinf->qname,
 227                                 rep->rrsets[i]->rk.dname) == 0) {
 228                                 val_find_rrset_signer(rep->rrsets[i],
 229                                         signer_name, signer_len);
 230                                 return;
 231                         }
 232                 }
 233                 *signer_name = NULL;
 234                 *signer_len = 0;
 235         } else if(subtype == VAL_CLASS_CNAME) {
 236                 /* check for the first signed cname/dname rrset */
 237                 for(i=skip; i<rep->an_numrrsets; i++) {
 238                         val_find_rrset_signer(rep->rrsets[i],
 239                                 signer_name, signer_len);
 240                         if(*signer_name)
 241                                 return;
 242                         if(ntohs(rep->rrsets[i]->rk.type) != LDNS_RR_TYPE_DNAME)
 243                                 break; /* only check CNAME after a DNAME */
 244                 }
 245                 *signer_name = NULL;
 246                 *signer_len = 0;
 247         } else if(subtype == VAL_CLASS_NAMEERROR
 248                 || subtype == VAL_CLASS_NODATA) {
 249                 /*Check to see if the AUTH section NSEC record(s) have rrsigs*/
 250                 for(i=rep->an_numrrsets; i<
 251                         rep->an_numrrsets+rep->ns_numrrsets; i++) {
 252                         if(ntohs(rep->rrsets[i]->rk.type) == LDNS_RR_TYPE_NSEC
 253                                 || ntohs(rep->rrsets[i]->rk.type) ==
 254                                 LDNS_RR_TYPE_NSEC3) {
 255                                 val_find_rrset_signer(rep->rrsets[i],
 256                                         signer_name, signer_len);
 257                                 return;
 258                         }
 259                 }
 260         } else if(subtype == VAL_CLASS_CNAMENOANSWER) {
 261                 /* find closest superdomain signer name in authority section
 262                  * NSEC and NSEC3s */
 263                 int matchcount = 0;
 264                 *signer_name = NULL;
 265                 *signer_len = 0;
 266                 for(i=rep->an_numrrsets; i<rep->an_numrrsets+rep->
 267                         ns_numrrsets; i++) {
 268                         if(ntohs(rep->rrsets[i]->rk.type) == LDNS_RR_TYPE_NSEC
 269                                 || ntohs(rep->rrsets[i]->rk.type) ==
 270                                 LDNS_RR_TYPE_NSEC3) {
 271                                 val_find_best_signer(rep->rrsets[i], qinf,
 272                                         signer_name, signer_len, &matchcount);
 273                         }
 274                 }
 275         } else if(subtype == VAL_CLASS_ANY) {
 276                 /* check for one of the answer rrset that has signatures,
 277                  * or potentially a DNAME is in use with a different qname */
 278                 for(i=skip; i<rep->an_numrrsets; i++) {
 279                         if(query_dname_compare(qinf->qname,
 280                                 rep->rrsets[i]->rk.dname) == 0) {
 281                                 val_find_rrset_signer(rep->rrsets[i],
 282                                         signer_name, signer_len);
 283                                 if(*signer_name)
 284                                         return;
 285                         }
 286                 }
 287                 /* no answer RRSIGs with qname, try a DNAME */
 288                 if(skip < rep->an_numrrsets &&
 289                         ntohs(rep->rrsets[skip]->rk.type) ==
 290                         LDNS_RR_TYPE_DNAME) {
 291                         val_find_rrset_signer(rep->rrsets[skip],
 292                                 signer_name, signer_len);
 293                         if(*signer_name)
 294                                 return;
 295                 }
 296                 *signer_name = NULL;
 297                 *signer_len = 0;
 298         } else if(subtype == VAL_CLASS_REFERRAL) {
 299                 /* find keys for the item at skip */
 300                 if(skip < rep->rrset_count) {
 301                         val_find_rrset_signer(rep->rrsets[skip],
 302                                 signer_name, signer_len);
 303                         return;
 304                 }
 305                 *signer_name = NULL;
 306                 *signer_len = 0;
 307         } else {
 308                 verbose(VERB_QUERY, "find_signer: could not find signer name"
 309                         " for unknown type response");
 310                 *signer_name = NULL;
 311                 *signer_len = 0;
 312         }
 313 }
 314
 315 /** return number of rrs in an rrset */
 316 static size_t
 317 rrset_get_count(struct ub_packed_rrset_key* rrset)
 318 {
 319         struct packed_rrset_data* d = (struct packed_rrset_data*)
 320                 rrset->entry.data;
 321         if(!d) return 0;
 322         return d->count;
 323 }
 324
 325 /** return TTL of rrset */
 326 static uint32_t
 327 rrset_get_ttl(struct ub_packed_rrset_key* rrset)
 328 {
 329         struct packed_rrset_data* d = (struct packed_rrset_data*)
 330                 rrset->entry.data;
 331         if(!d) return 0;
 332         return d->ttl;
 333 }
 334
 335 enum sec_status
 336 val_verify_rrset(struct module_env* env, struct val_env* ve,
 337         struct ub_packed_rrset_key* rrset, struct ub_packed_rrset_key* keys,
 338         uint8_t* sigalg, char** reason, sldns_pkt_section section,
 339         struct module_qstate* qstate)
 340 {
 341         enum sec_status sec;
 342         struct packed_rrset_data* d = (struct packed_rrset_data*)rrset->
 343                 entry.data;
 344         if(d->security == sec_status_secure) {
 345                 /* re-verify all other statuses, because keyset may change*/
 346                 log_nametypeclass(VERB_ALGO, "verify rrset cached",
 347                         rrset->rk.dname, ntohs(rrset->rk.type),
 348                         ntohs(rrset->rk.rrset_class));
 349                 return d->security;
 350         }
 351         /* check in the cache if verification has already been done */
 352         rrset_check_sec_status(env->rrset_cache, rrset, *env->now);
 353         if(d->security == sec_status_secure) {
 354                 log_nametypeclass(VERB_ALGO, "verify rrset from cache",
 355                         rrset->rk.dname, ntohs(rrset->rk.type),
 356                         ntohs(rrset->rk.rrset_class));
 357                 return d->security;
 358         }
 359         log_nametypeclass(VERB_ALGO, "verify rrset", rrset->rk.dname,
 360                 ntohs(rrset->rk.type), ntohs(rrset->rk.rrset_class));
 361         sec = dnskeyset_verify_rrset(env, ve, rrset, keys, sigalg, reason,
 362                 section, qstate);
 363         verbose(VERB_ALGO, "verify result: %s", sec_status_to_string(sec));
 364         regional_free_all(env->scratch);
 365
 366         /* update rrset security status
 367          * only improves security status
 368          * and bogus is set only once, even if we rechecked the status */
 369         if(sec > d->security) {
 370                 d->security = sec;
 371                 if(sec == sec_status_secure)
 372                         d->trust = rrset_trust_validated;
 373                 else if(sec == sec_status_bogus) {
 374                         size_t i;
 375                         /* update ttl for rrset to fixed value. */
 376                         d->ttl = ve->bogus_ttl;
 377                         for(i=0; i<d->count+d->rrsig_count; i++)
 378                                 d->rr_ttl[i] = ve->bogus_ttl;
 379                         /* leave RR specific TTL: not used for determine
 380                          * if RRset timed out and clients see proper value. */
 381                         lock_basic_lock(&ve->bogus_lock);
 382                         ve->num_rrset_bogus++;
 383                         lock_basic_unlock(&ve->bogus_lock);
 384                 }
 385                 /* if status updated - store in cache for reuse */
 386                 rrset_update_sec_status(env->rrset_cache, rrset, *env->now);
 387         }
 388
 389         return sec;
 390 }
 391
 392 enum sec_status
 393 val_verify_rrset_entry(struct module_env* env, struct val_env* ve,
 394         struct ub_packed_rrset_key* rrset, struct key_entry_key* kkey,
 395         char** reason, sldns_pkt_section section, struct module_qstate* qstate)
 396 {
 397         /* temporary dnskey rrset-key */
 398         struct ub_packed_rrset_key dnskey;
 399         struct key_entry_data* kd = (struct key_entry_data*)kkey->entry.data;
 400         enum sec_status sec;
 401         dnskey.rk.type = htons(kd->rrset_type);
 402         dnskey.rk.rrset_class = htons(kkey->key_class);
 403         dnskey.rk.flags = 0;
 404         dnskey.rk.dname = kkey->name;
 405         dnskey.rk.dname_len = kkey->namelen;
 406         dnskey.entry.key = &dnskey;
 407         dnskey.entry.data = kd->rrset_data;
 408         sec = val_verify_rrset(env, ve, rrset, &dnskey, kd->algo, reason,
 409                 section, qstate);
 410         return sec;
 411 }
 412
 413 /** verify that a DS RR hashes to a key and that key signs the set */
 414 static enum sec_status
 415 verify_dnskeys_with_ds_rr(struct module_env* env, struct val_env* ve,
 416         struct ub_packed_rrset_key* dnskey_rrset,
 417         struct ub_packed_rrset_key* ds_rrset, size_t ds_idx, char** reason,
 418         struct module_qstate* qstate)
 419 {
 420         enum sec_status sec = sec_status_bogus;
 421         size_t i, num, numchecked = 0, numhashok = 0;
 422         num = rrset_get_count(dnskey_rrset);
 423         for(i=0; i<num; i++) {
 424                 /* Skip DNSKEYs that don't match the basic criteria. */
 425                 if(ds_get_key_algo(ds_rrset, ds_idx)
 426                    != dnskey_get_algo(dnskey_rrset, i)
 427                    || dnskey_calc_keytag(dnskey_rrset, i)
 428                    != ds_get_keytag(ds_rrset, ds_idx)) {
 429                         continue;
 430                 }
 431                 numchecked++;
 432                 verbose(VERB_ALGO, "attempt DS match algo %d keytag %d",
 433                         ds_get_key_algo(ds_rrset, ds_idx),
 434                         ds_get_keytag(ds_rrset, ds_idx));
 435
 436                 /* Convert the candidate DNSKEY into a hash using the
 437                  * same DS hash algorithm. */
 438                 if(!ds_digest_match_dnskey(env, dnskey_rrset, i, ds_rrset,
 439                         ds_idx)) {
 440                         verbose(VERB_ALGO, "DS match attempt failed");
 441                         continue;
 442                 }
 443                 numhashok++;
 444                 verbose(VERB_ALGO, "DS match digest ok, trying signature");
 445
 446                 /* Otherwise, we have a match! Make sure that the DNSKEY
 447                  * verifies *with this key*  */
 448                 sec = dnskey_verify_rrset(env, ve, dnskey_rrset,
 449                         dnskey_rrset, i, reason, LDNS_SECTION_ANSWER, qstate);
 450                 if(sec == sec_status_secure) {
 451                         return sec;
 452                 }
 453                 /* If it didn't validate with the DNSKEY, try the next one! */
 454         }
 455         if(numchecked == 0)
 456                 algo_needs_reason(env, ds_get_key_algo(ds_rrset, ds_idx),
 457                         reason, "no keys have a DS");
 458         else if(numhashok == 0)
 459                 *reason = "DS hash mismatches key";
 460         else if(!*reason)
 461                 *reason = "keyset not secured by DNSKEY that matches DS";
 462         return sec_status_bogus;
 463 }
 464
 465 int val_favorite_ds_algo(struct ub_packed_rrset_key* ds_rrset)
 466 {
 467         size_t i, num = rrset_get_count(ds_rrset);
 468         int d, digest_algo = 0; /* DS digest algo 0 is not used. */
 469         /* find favorite algo, for now, highest number supported */
 470         for(i=0; i<num; i++) {
 471                 if(!ds_digest_algo_is_supported(ds_rrset, i) ||
 472                         !ds_key_algo_is_supported(ds_rrset, i)) {
 473                         continue;
 474                 }
 475                 d = ds_get_digest_algo(ds_rrset, i);
 476                 if(d > digest_algo)
 477                         digest_algo = d;
 478         }
 479         return digest_algo;
 480 }
 481
 482 enum sec_status
 483 val_verify_DNSKEY_with_DS(struct module_env* env, struct val_env* ve,
 484         struct ub_packed_rrset_key* dnskey_rrset,
 485         struct ub_packed_rrset_key* ds_rrset, uint8_t* sigalg, char** reason,
 486         struct module_qstate* qstate)
 487 {
 488         /* as long as this is false, we can consider this DS rrset to be
 489          * equivalent to no DS rrset. */
 490         int has_useful_ds = 0, digest_algo, alg;
 491         struct algo_needs needs;
 492         size_t i, num;
 493         enum sec_status sec;
 494
 495         if(dnskey_rrset->rk.dname_len != ds_rrset->rk.dname_len ||
 496                 query_dname_compare(dnskey_rrset->rk.dname, ds_rrset->rk.dname)
 497                 != 0) {
 498                 verbose(VERB_QUERY, "DNSKEY RRset did not match DS RRset "
 499                         "by name");
 500                 *reason = "DNSKEY RRset did not match DS RRset by name";
 501                 return sec_status_bogus;
 502         }
 503
 504         if(sigalg) {
 505                 /* harden against algo downgrade is enabled */
 506                 digest_algo = val_favorite_ds_algo(ds_rrset);
 507                 algo_needs_init_ds(&needs, ds_rrset, digest_algo, sigalg);
 508         } else {
 509                 /* accept any key algo, any digest algo */
 510                 digest_algo = -1;
 511         }
 512         num = rrset_get_count(ds_rrset);
 513         for(i=0; i<num; i++) {
 514                 /* Check to see if we can understand this DS.
 515                  * And check it is the strongest digest */
 516                 if(!ds_digest_algo_is_supported(ds_rrset, i) ||
 517                         !ds_key_algo_is_supported(ds_rrset, i) ||
 518                         (sigalg && (ds_get_digest_algo(ds_rrset, i) != digest_algo))) {
 519                         continue;
 520                 }
 521
 522                 /* Once we see a single DS with a known digestID and
 523                  * algorithm, we cannot return INSECURE (with a
 524                  * "null" KeyEntry). */
 525                 has_useful_ds = 1;
 526
 527                 sec = verify_dnskeys_with_ds_rr(env, ve, dnskey_rrset,
 528                         ds_rrset, i, reason, qstate);
 529                 if(sec == sec_status_secure) {
 530                         if(!sigalg || algo_needs_set_secure(&needs,
 531                                 (uint8_t)ds_get_key_algo(ds_rrset, i))) {
 532                                 verbose(VERB_ALGO, "DS matched DNSKEY.");
 533                                 return sec_status_secure;
 534                         }
 535                 } else if(sigalg && sec == sec_status_bogus) {
 536                         algo_needs_set_bogus(&needs,
 537                                 (uint8_t)ds_get_key_algo(ds_rrset, i));
 538                 }
 539         }
 540
 541         /* None of the DS's worked out. */
 542
 543         /* If no DSs were understandable, then this is OK. */
 544         if(!has_useful_ds) {
 545                 verbose(VERB_ALGO, "No usable DS records were found -- "
 546                         "treating as insecure.");
 547                 return sec_status_insecure;
 548         }
 549         /* If any were understandable, then it is bad. */
 550         verbose(VERB_QUERY, "Failed to match any usable DS to a DNSKEY.");
 551         if(sigalg && (alg=algo_needs_missing(&needs)) != 0) {
 552                 algo_needs_reason(env, alg, reason, "missing verification of "
 553                         "DNSKEY signature");
 554         }
 555         return sec_status_bogus;
 556 }
 557
 558 struct key_entry_key*
 559 val_verify_new_DNSKEYs(struct regional* region, struct module_env* env,
 560         struct val_env* ve, struct ub_packed_rrset_key* dnskey_rrset,
 561         struct ub_packed_rrset_key* ds_rrset, int downprot, char** reason,
 562         struct module_qstate* qstate)
 563 {
 564         uint8_t sigalg[ALGO_NEEDS_MAX+1];
 565         enum sec_status sec = val_verify_DNSKEY_with_DS(env, ve,
 566                 dnskey_rrset, ds_rrset, downprot?sigalg:NULL, reason, qstate);
 567
 568         if(sec == sec_status_secure) {
 569                 return key_entry_create_rrset(region,
 570                         ds_rrset->rk.dname, ds_rrset->rk.dname_len,
 571                         ntohs(ds_rrset->rk.rrset_class), dnskey_rrset,
 572                         downprot?sigalg:NULL, *env->now);
 573         } else if(sec == sec_status_insecure) {
 574                 return key_entry_create_null(region, ds_rrset->rk.dname,
 575                         ds_rrset->rk.dname_len,
 576                         ntohs(ds_rrset->rk.rrset_class),
 577                         rrset_get_ttl(ds_rrset), *env->now);
 578         }
 579         return key_entry_create_bad(region, ds_rrset->rk.dname,
 580                 ds_rrset->rk.dname_len, ntohs(ds_rrset->rk.rrset_class),
 581                 BOGUS_KEY_TTL, *env->now);
 582 }
 583
 584 enum sec_status
 585 val_verify_DNSKEY_with_TA(struct module_env* env, struct val_env* ve,
 586         struct ub_packed_rrset_key* dnskey_rrset,
 587         struct ub_packed_rrset_key* ta_ds,
 588         struct ub_packed_rrset_key* ta_dnskey, uint8_t* sigalg, char** reason,
 589         struct module_qstate* qstate)
 590 {
 591         /* as long as this is false, we can consider this anchor to be
 592          * equivalent to no anchor. */
 593         int has_useful_ta = 0, digest_algo = 0, alg;
 594         struct algo_needs needs;
 595         size_t i, num;
 596         enum sec_status sec;
 597
 598         if(ta_ds && (dnskey_rrset->rk.dname_len != ta_ds->rk.dname_len ||
 599                 query_dname_compare(dnskey_rrset->rk.dname, ta_ds->rk.dname)
 600                 != 0)) {
 601                 verbose(VERB_QUERY, "DNSKEY RRset did not match DS RRset "
 602                         "by name");
 603                 *reason = "DNSKEY RRset did not match DS RRset by name";
 604                 return sec_status_bogus;
 605         }
 606         if(ta_dnskey && (dnskey_rrset->rk.dname_len != ta_dnskey->rk.dname_len
 607              || query_dname_compare(dnskey_rrset->rk.dname, ta_dnskey->rk.dname)
 608                 != 0)) {
 609                 verbose(VERB_QUERY, "DNSKEY RRset did not match anchor RRset "
 610                         "by name");
 611                 *reason = "DNSKEY RRset did not match anchor RRset by name";
 612                 return sec_status_bogus;
 613         }
 614
 615         if(ta_ds)
 616                 digest_algo = val_favorite_ds_algo(ta_ds);
 617         if(sigalg) {
 618                 if(ta_ds)
 619                         algo_needs_init_ds(&needs, ta_ds, digest_algo, sigalg);
 620                 else    memset(&needs, 0, sizeof(needs));
 621                 if(ta_dnskey)
 622                         algo_needs_init_dnskey_add(&needs, ta_dnskey, sigalg);
 623         }
 624         if(ta_ds) {
 625             num = rrset_get_count(ta_ds);
 626             for(i=0; i<num; i++) {
 627                 /* Check to see if we can understand this DS.
 628                  * And check it is the strongest digest */
 629                 if(!ds_digest_algo_is_supported(ta_ds, i) ||
 630                         !ds_key_algo_is_supported(ta_ds, i) ||
 631                         ds_get_digest_algo(ta_ds, i) != digest_algo)
 632                         continue;
 633
 634                 /* Once we see a single DS with a known digestID and
 635                  * algorithm, we cannot return INSECURE (with a
 636                  * "null" KeyEntry). */
 637                 has_useful_ta = 1;
 638
 639                 sec = verify_dnskeys_with_ds_rr(env, ve, dnskey_rrset,
 640                         ta_ds, i, reason, qstate);
 641                 if(sec == sec_status_secure) {
 642                         if(!sigalg || algo_needs_set_secure(&needs,
 643                                 (uint8_t)ds_get_key_algo(ta_ds, i))) {
 644                                 verbose(VERB_ALGO, "DS matched DNSKEY.");
 645                                 return sec_status_secure;
 646                         }
 647                 } else if(sigalg && sec == sec_status_bogus) {
 648                         algo_needs_set_bogus(&needs,
 649                                 (uint8_t)ds_get_key_algo(ta_ds, i));
 650                 }
 651             }
 652         }
 653
 654         /* None of the DS's worked out: check the DNSKEYs. */
 655         if(ta_dnskey) {
 656             num = rrset_get_count(ta_dnskey);
 657             for(i=0; i<num; i++) {
 658                 /* Check to see if we can understand this DNSKEY */
 659                 if(!dnskey_algo_is_supported(ta_dnskey, i))
 660                         continue;
 661
 662                 /* we saw a useful TA */
 663                 has_useful_ta = 1;
 664
 665                 sec = dnskey_verify_rrset(env, ve, dnskey_rrset,
 666                         ta_dnskey, i, reason, LDNS_SECTION_ANSWER, qstate);
 667                 if(sec == sec_status_secure) {
 668                         if(!sigalg || algo_needs_set_secure(&needs,
 669                                 (uint8_t)dnskey_get_algo(ta_dnskey, i))) {
 670                                 verbose(VERB_ALGO, "anchor matched DNSKEY.");
 671                                 return sec_status_secure;
 672                         }
 673                 } else if(sigalg && sec == sec_status_bogus) {
 674                         algo_needs_set_bogus(&needs,
 675                                 (uint8_t)dnskey_get_algo(ta_dnskey, i));
 676                 }
 677             }
 678         }
 679
 680         /* If no DSs were understandable, then this is OK. */
 681         if(!has_useful_ta) {
 682                 verbose(VERB_ALGO, "No usable trust anchors were found -- "
 683                         "treating as insecure.");
 684                 return sec_status_insecure;
 685         }
 686         /* If any were understandable, then it is bad. */
 687         verbose(VERB_QUERY, "Failed to match any usable anchor to a DNSKEY.");
 688         if(sigalg && (alg=algo_needs_missing(&needs)) != 0) {
 689                 algo_needs_reason(env, alg, reason, "missing verification of "
 690                         "DNSKEY signature");
 691         }
 692         return sec_status_bogus;
 693 }
 694
 695 struct key_entry_key*
 696 val_verify_new_DNSKEYs_with_ta(struct regional* region, struct module_env* env,
 697         struct val_env* ve, struct ub_packed_rrset_key* dnskey_rrset,
 698         struct ub_packed_rrset_key* ta_ds_rrset,
 699         struct ub_packed_rrset_key* ta_dnskey_rrset, int downprot,
 700         char** reason, struct module_qstate* qstate)
 701 {
 702         uint8_t sigalg[ALGO_NEEDS_MAX+1];
 703         enum sec_status sec = val_verify_DNSKEY_with_TA(env, ve,
 704                 dnskey_rrset, ta_ds_rrset, ta_dnskey_rrset,
 705                 downprot?sigalg:NULL, reason, qstate);
 706
 707         if(sec == sec_status_secure) {
 708                 return key_entry_create_rrset(region,
 709                         dnskey_rrset->rk.dname, dnskey_rrset->rk.dname_len,
 710                         ntohs(dnskey_rrset->rk.rrset_class), dnskey_rrset,
 711                         downprot?sigalg:NULL, *env->now);
 712         } else if(sec == sec_status_insecure) {
 713                 return key_entry_create_null(region, dnskey_rrset->rk.dname,
 714                         dnskey_rrset->rk.dname_len,
 715                         ntohs(dnskey_rrset->rk.rrset_class),
 716                         rrset_get_ttl(dnskey_rrset), *env->now);
 717         }
 718         return key_entry_create_bad(region, dnskey_rrset->rk.dname,
 719                 dnskey_rrset->rk.dname_len, ntohs(dnskey_rrset->rk.rrset_class),
 720                 BOGUS_KEY_TTL, *env->now);
 721 }
 722
 723 int
 724 val_dsset_isusable(struct ub_packed_rrset_key* ds_rrset)
 725 {
 726         size_t i;
 727         for(i=0; i<rrset_get_count(ds_rrset); i++) {
 728                 if(ds_digest_algo_is_supported(ds_rrset, i) &&
 729                         ds_key_algo_is_supported(ds_rrset, i))
 730                         return 1;
 731         }
 732         if(verbosity < VERB_ALGO)
 733                 return 0;
 734         if(rrset_get_count(ds_rrset) == 0)
 735                 verbose(VERB_ALGO, "DS is not usable");
 736         else {
 737                 /* report usability for the first DS RR */
 738                 sldns_lookup_table *lt;
 739                 char herr[64], aerr[64];
 740                 lt = sldns_lookup_by_id(sldns_hashes,
 741                         (int)ds_get_digest_algo(ds_rrset, i));
 742                 if(lt) snprintf(herr, sizeof(herr), "%s", lt->name);
 743                 else snprintf(herr, sizeof(herr), "%d",
 744                         (int)ds_get_digest_algo(ds_rrset, i));
 745                 lt = sldns_lookup_by_id(sldns_algorithms,
 746                         (int)ds_get_key_algo(ds_rrset, i));
 747                 if(lt) snprintf(aerr, sizeof(aerr), "%s", lt->name);
 748                 else snprintf(aerr, sizeof(aerr), "%d",
 749                         (int)ds_get_key_algo(ds_rrset, i));
 750                 verbose(VERB_ALGO, "DS unsupported, hash %s %s, "
 751                         "key algorithm %s %s", herr,
 752                         (ds_digest_algo_is_supported(ds_rrset, 0)?
 753                         "(supported)":"(unsupported)"), aerr,
 754                         (ds_key_algo_is_supported(ds_rrset, 0)?
 755                         "(supported)":"(unsupported)"));
 756         }
 757         return 0;
 758 }
 759
 760 /** get label count for a signature */
 761 static uint8_t
 762 rrsig_get_labcount(struct packed_rrset_data* d, size_t sig)
 763 {
 764         if(d->rr_len[sig] < 2+4)
 765                 return 0; /* bad sig length */
 766         return d->rr_data[sig][2+3];
 767 }
 768
 769 int
 770 val_rrset_wildcard(struct ub_packed_rrset_key* rrset, uint8_t** wc,
 771         size_t* wc_len)
 772 {
 773         struct packed_rrset_data* d = (struct packed_rrset_data*)rrset->
 774                 entry.data;
 775         uint8_t labcount;
 776         int labdiff;
 777         uint8_t* wn;
 778         size_t i, wl;
 779         if(d->rrsig_count == 0) {
 780                 return 1;
 781         }
 782         labcount = rrsig_get_labcount(d, d->count + 0);
 783         /* check rest of signatures identical */
 784         for(i=1; i<d->rrsig_count; i++) {
 785                 if(labcount != rrsig_get_labcount(d, d->count + i)) {
 786                         return 0;
 787                 }
 788         }
 789         /* OK the rrsigs check out */
 790         /* if the RRSIG label count is shorter than the number of actual
 791          * labels, then this rrset was synthesized from a wildcard.
 792          * Note that the RRSIG label count doesn't count the root label. */
 793         wn = rrset->rk.dname;
 794         wl = rrset->rk.dname_len;
 795         /* skip a leading wildcard label in the dname (RFC4035 2.2) */
 796         if(dname_is_wild(wn)) {
 797                 wn += 2;
 798                 wl -= 2;
 799         }
 800         labdiff = (dname_count_labels(wn) - 1) - (int)labcount;
 801         if(labdiff > 0) {
 802                 *wc = wn;
 803                 dname_remove_labels(wc, &wl, labdiff);
 804                 *wc_len = wl;
 805                 return 1;
 806         }
 807         return 1;
 808 }
 809
 810 int
 811 val_chase_cname(struct query_info* qchase, struct reply_info* rep,
 812         size_t* cname_skip) {
 813         size_t i;
 814         /* skip any DNAMEs, go to the CNAME for next part */
 815         for(i = *cname_skip; i < rep->an_numrrsets; i++) {
 816                 if(ntohs(rep->rrsets[i]->rk.type) == LDNS_RR_TYPE_CNAME &&
 817                         query_dname_compare(qchase->qname, rep->rrsets[i]->
 818                                 rk.dname) == 0) {
 819                         qchase->qname = NULL;
 820                         get_cname_target(rep->rrsets[i], &qchase->qname,
 821                                 &qchase->qname_len);
 822                         if(!qchase->qname)
 823                                 return 0; /* bad CNAME rdata */
 824                         (*cname_skip) = i+1;
 825                         return 1;
 826                 }
 827         }
 828         return 0; /* CNAME classified but no matching CNAME ?! */
 829 }
 830
 831 /** see if rrset has signer name as one of the rrsig signers */
 832 static int
 833 rrset_has_signer(struct ub_packed_rrset_key* rrset, uint8_t* name, size_t len)
 834 {
 835         struct packed_rrset_data* d = (struct packed_rrset_data*)rrset->
 836                 entry.data;
 837         size_t i;
 838         for(i = d->count; i< d->count+d->rrsig_count; i++) {
 839                 if(d->rr_len[i] > 2+18+len) {
 840                         /* at least rdatalen + signature + signame (+1 sig)*/
 841                         if(!dname_valid(d->rr_data[i]+2+18, d->rr_len[i]-2-18))
 842                                 continue;
 843                         if(query_dname_compare(name, d->rr_data[i]+2+18) == 0)
 844                         {
 845                                 return 1;
 846                         }
 847                 }
 848         }
 849         return 0;
 850 }
 851
 852 void
 853 val_fill_reply(struct reply_info* chase, struct reply_info* orig,
 854         size_t skip, uint8_t* name, size_t len, uint8_t* signer)
 855 {
 856         size_t i;
 857         int seen_dname = 0;
 858         chase->rrset_count = 0;
 859         chase->an_numrrsets = 0;
 860         chase->ns_numrrsets = 0;
 861         chase->ar_numrrsets = 0;
 862         /* ANSWER section */
 863         for(i=skip; i<orig->an_numrrsets; i++) {
 864                 if(!signer) {
 865                         if(query_dname_compare(name,
 866                                 orig->rrsets[i]->rk.dname) == 0)
 867                                 chase->rrsets[chase->an_numrrsets++] =
 868                                         orig->rrsets[i];
 869                 } else if(seen_dname && ntohs(orig->rrsets[i]->rk.type) ==
 870                         LDNS_RR_TYPE_CNAME) {
 871                         chase->rrsets[chase->an_numrrsets++] = orig->rrsets[i];
 872                         seen_dname = 0;
 873                 } else if(rrset_has_signer(orig->rrsets[i], name, len)) {
 874                         chase->rrsets[chase->an_numrrsets++] = orig->rrsets[i];
 875                         if(ntohs(orig->rrsets[i]->rk.type) ==
 876                                 LDNS_RR_TYPE_DNAME) {
 877                                         seen_dname = 1;
 878                         }
 879                 }
 880         }
 881         /* AUTHORITY section */
 882         for(i = (skip > orig->an_numrrsets)?skip:orig->an_numrrsets;
 883                 i<orig->an_numrrsets+orig->ns_numrrsets;
 884                 i++) {
 885                 if(!signer) {
 886                         if(query_dname_compare(name,
 887                                 orig->rrsets[i]->rk.dname) == 0)
 888                                 chase->rrsets[chase->an_numrrsets+
 889                                     chase->ns_numrrsets++] = orig->rrsets[i];
 890                 } else if(rrset_has_signer(orig->rrsets[i], name, len)) {
 891                         chase->rrsets[chase->an_numrrsets+
 892                                 chase->ns_numrrsets++] = orig->rrsets[i];
 893                 }
 894         }
 895         /* ADDITIONAL section */
 896         for(i= (skip>orig->an_numrrsets+orig->ns_numrrsets)?
 897                 skip:orig->an_numrrsets+orig->ns_numrrsets;
 898                 i<orig->rrset_count; i++) {
 899                 if(!signer) {
 900                         if(query_dname_compare(name,
 901                                 orig->rrsets[i]->rk.dname) == 0)
 902                             chase->rrsets[chase->an_numrrsets
 903                                 +orig->ns_numrrsets+chase->ar_numrrsets++]
 904                                 = orig->rrsets[i];
 905                 } else if(rrset_has_signer(orig->rrsets[i], name, len)) {
 906                         chase->rrsets[chase->an_numrrsets+orig->ns_numrrsets+
 907                                 chase->ar_numrrsets++] = orig->rrsets[i];
 908                 }
 909         }
 910         chase->rrset_count = chase->an_numrrsets + chase->ns_numrrsets +
 911                 chase->ar_numrrsets;
 912 }
 913
 914 void val_reply_remove_auth(struct reply_info* rep, size_t index)
 915 {
 916         log_assert(index < rep->rrset_count);
 917         log_assert(index >= rep->an_numrrsets);
 918         log_assert(index < rep->an_numrrsets+rep->ns_numrrsets);
 919         memmove(rep->rrsets+index, rep->rrsets+index+1,
 920                 sizeof(struct ub_packed_rrset_key*)*
 921                 (rep->rrset_count - index - 1));
 922         rep->ns_numrrsets--;
 923         rep->rrset_count--;
 924 }
 925
 926 void
 927 val_check_nonsecure(struct module_env* env, struct reply_info* rep)
 928 {
 929         size_t i;
 930         /* authority */
 931         for(i=rep->an_numrrsets; i<rep->an_numrrsets+rep->ns_numrrsets; i++) {
 932                 if(((struct packed_rrset_data*)rep->rrsets[i]->entry.data)
 933                         ->security != sec_status_secure) {
 934                         /* because we want to return the authentic original
 935                          * message when presented with CD-flagged queries,
 936                          * we need to preserve AUTHORITY section data.
 937                          * However, this rrset is not signed or signed
 938                          * with the wrong keys. Validation has tried to
 939                          * verify this rrset with the keysets of import.
 940                          * But this rrset did not verify.
 941                          * Therefore the message is bogus.
 942                          */
 943
 944                         /* check if authority has an NS record
 945                          * which is bad, and there is an answer section with
 946                          * data.  In that case, delete NS and additional to
 947                          * be lenient and make a minimal response */
 948                         if(rep->an_numrrsets != 0 &&
 949                                 ntohs(rep->rrsets[i]->rk.type)
 950                                 == LDNS_RR_TYPE_NS) {
 951                                 verbose(VERB_ALGO, "truncate to minimal");
 952                                 rep->ar_numrrsets = 0;
 953                                 rep->rrset_count = rep->an_numrrsets +
 954                                         rep->ns_numrrsets;
 955                                 /* remove this unneeded authority rrset */
 956                                 memmove(rep->rrsets+i, rep->rrsets+i+1,
 957                                         sizeof(struct ub_packed_rrset_key*)*
 958                                         (rep->rrset_count - i - 1));
 959                                 rep->ns_numrrsets--;
 960                                 rep->rrset_count--;
 961                                 i--;
 962                                 return;
 963                         }
 964
 965                         log_nametypeclass(VERB_QUERY, "message is bogus, "
 966                                 "non secure rrset",
 967                                 rep->rrsets[i]->rk.dname,
 968                                 ntohs(rep->rrsets[i]->rk.type),
 969                                 ntohs(rep->rrsets[i]->rk.rrset_class));
 970                         rep->security = sec_status_bogus;
 971                         return;
 972                 }
 973         }
 974         /* additional */
 975         if(!env->cfg->val_clean_additional)
 976                 return;
 977         for(i=rep->an_numrrsets+rep->ns_numrrsets; i<rep->rrset_count; i++) {
 978                 if(((struct packed_rrset_data*)rep->rrsets[i]->entry.data)
 979                         ->security != sec_status_secure) {
 980                         /* This does not cause message invalidation. It was
 981                          * simply unsigned data in the additional. The
 982                          * RRSIG must have been truncated off the message.
 983                          *
 984                          * However, we do not want to return possible bogus
 985                          * data to clients that rely on this service for
 986                          * their authentication.
 987                          */
 988                         /* remove this unneeded additional rrset */
 989                         memmove(rep->rrsets+i, rep->rrsets+i+1,
 990                                 sizeof(struct ub_packed_rrset_key*)*
 991                                 (rep->rrset_count - i - 1));
 992                         rep->ar_numrrsets--;
 993                         rep->rrset_count--;
 994                         i--;
 995                 }
 996         }
 997 }
 998
 999 /** check no anchor and unlock */
1000 static int
1001 check_no_anchor(struct val_anchors* anchors, uint8_t* nm, size_t l, uint16_t c)
1002 {
1003         struct trust_anchor* ta;
1004         if((ta=anchors_lookup(anchors, nm, l, c))) {
1005                 lock_basic_unlock(&ta->lock);
1006         }
1007         return !ta;
1008 }
1009
1010 void
1011 val_mark_indeterminate(struct reply_info* rep, struct val_anchors* anchors,
1012         struct rrset_cache* r, struct module_env* env)
1013 {
1014         size_t i;
1015         struct packed_rrset_data* d;
1016         for(i=0; i<rep->rrset_count; i++) {
1017                 d = (struct packed_rrset_data*)rep->rrsets[i]->entry.data;
1018                 if(d->security == sec_status_unchecked &&
1019                    check_no_anchor(anchors, rep->rrsets[i]->rk.dname,
1020                         rep->rrsets[i]->rk.dname_len,
1021                         ntohs(rep->rrsets[i]->rk.rrset_class)))
1022                 {
1023                         /* mark as indeterminate */
1024                         d->security = sec_status_indeterminate;
1025                         rrset_update_sec_status(r, rep->rrsets[i], *env->now);
1026                 }
1027         }
1028 }
1029
1030 void
1031 val_mark_insecure(struct reply_info* rep, uint8_t* kname,
1032         struct rrset_cache* r, struct module_env* env)
1033 {
1034         size_t i;
1035         struct packed_rrset_data* d;
1036         for(i=0; i<rep->rrset_count; i++) {
1037                 d = (struct packed_rrset_data*)rep->rrsets[i]->entry.data;
1038                 if(d->security == sec_status_unchecked &&
1039                    dname_subdomain_c(rep->rrsets[i]->rk.dname, kname)) {
1040                         /* mark as insecure */
1041                         d->security = sec_status_insecure;
1042                         rrset_update_sec_status(r, rep->rrsets[i], *env->now);
1043                 }
1044         }
1045 }
1046
1047 size_t
1048 val_next_unchecked(struct reply_info* rep, size_t skip)
1049 {
1050         size_t i;
1051         struct packed_rrset_data* d;
1052         for(i=skip+1; i<rep->rrset_count; i++) {
1053                 d = (struct packed_rrset_data*)rep->rrsets[i]->entry.data;
1054                 if(d->security == sec_status_unchecked) {
1055                         return i;
1056                 }
1057         }
1058         return rep->rrset_count;
1059 }
1060
1061 const char*
1062 val_classification_to_string(enum val_classification subtype)
1063 {
1064         switch(subtype) {
1065                 case VAL_CLASS_UNTYPED:         return "untyped";
1066                 case VAL_CLASS_UNKNOWN:         return "unknown";
1067                 case VAL_CLASS_POSITIVE:        return "positive";
1068                 case VAL_CLASS_CNAME:           return "cname";
1069                 case VAL_CLASS_NODATA:          return "nodata";
1070                 case VAL_CLASS_NAMEERROR:       return "nameerror";
1071                 case VAL_CLASS_CNAMENOANSWER:   return "cnamenoanswer";
1072                 case VAL_CLASS_REFERRAL:        return "referral";
1073                 case VAL_CLASS_ANY:             return "qtype_any";
1074                 default:
1075                         return "bad_val_classification";
1076         }
1077 }
1078
1079 /** log a sock_list entry */
1080 static void
1081 sock_list_logentry(enum verbosity_value v, const char* s, struct sock_list* p)
1082 {
1083         if(p->len)
1084                 log_addr(v, s, &p->addr, p->len);
1085         else    verbose(v, "%s cache", s);
1086 }
1087
1088 void val_blacklist(struct sock_list** blacklist, struct regional* region,
1089         struct sock_list* origin, int cross)
1090 {
1091         /* debug printout */
1092         if(verbosity >= VERB_ALGO) {
1093                 struct sock_list* p;
1094                 for(p=*blacklist; p; p=p->next)
1095                         sock_list_logentry(VERB_ALGO, "blacklist", p);
1096                 if(!origin)
1097                         verbose(VERB_ALGO, "blacklist add: cache");
1098                 for(p=origin; p; p=p->next)
1099                         sock_list_logentry(VERB_ALGO, "blacklist add", p);
1100         }
1101         /* blacklist the IPs or the cache */
1102         if(!origin) {
1103                 /* only add if nothing there. anything else also stops cache*/
1104                 if(!*blacklist)
1105                         sock_list_insert(blacklist, NULL, 0, region);
1106         } else if(!cross)
1107                 sock_list_prepend(blacklist, origin);
1108         else    sock_list_merge(blacklist, region, origin);
1109 }
1110
1111 int val_has_signed_nsecs(struct reply_info* rep, char** reason)
1112 {
1113         size_t i, num_nsec = 0, num_nsec3 = 0;
1114         struct packed_rrset_data* d;
1115         for(i=rep->an_numrrsets; i<rep->an_numrrsets+rep->ns_numrrsets; i++) {
1116                 if(rep->rrsets[i]->rk.type == htons(LDNS_RR_TYPE_NSEC))
1117                         num_nsec++;
1118                 else if(rep->rrsets[i]->rk.type == htons(LDNS_RR_TYPE_NSEC3))
1119                         num_nsec3++;
1120                 else continue;
1121                 d = (struct packed_rrset_data*)rep->rrsets[i]->entry.data;
1122                 if(d && d->rrsig_count != 0) {
1123                         return 1;
1124                 }
1125         }
1126         if(num_nsec == 0 && num_nsec3 == 0)
1127                 *reason = "no DNSSEC records";
1128         else if(num_nsec != 0)
1129                 *reason = "no signatures over NSECs";
1130         else    *reason = "no signatures over NSEC3s";
1131         return 0;
1132 }
1133
1134 struct dns_msg*
1135 val_find_DS(struct module_env* env, uint8_t* nm, size_t nmlen, uint16_t c,
1136         struct regional* region, uint8_t* topname)
1137 {
1138         struct dns_msg* msg;
1139         struct query_info qinfo;
1140         struct ub_packed_rrset_key *rrset = rrset_cache_lookup(
1141                 env->rrset_cache, nm, nmlen, LDNS_RR_TYPE_DS, c, 0,
1142                 *env->now, 0);
1143         if(rrset) {
1144                 /* DS rrset exists. Return it to the validator immediately*/
1145                 struct ub_packed_rrset_key* copy = packed_rrset_copy_region(
1146                         rrset, region, *env->now);
1147                 lock_rw_unlock(&rrset->entry.lock);
1148                 if(!copy)
1149                         return NULL;
1150                 msg = dns_msg_create(nm, nmlen, LDNS_RR_TYPE_DS, c, region, 1);
1151                 if(!msg)
1152                         return NULL;
1153                 msg->rep->rrsets[0] = copy;
1154                 msg->rep->rrset_count++;
1155                 msg->rep->an_numrrsets++;
1156                 return msg;
1157         }
1158         /* lookup in rrset and negative cache for NSEC/NSEC3 */
1159         qinfo.qname = nm;
1160         qinfo.qname_len = nmlen;
1161         qinfo.qtype = LDNS_RR_TYPE_DS;
1162         qinfo.qclass = c;
1163         qinfo.local_alias = NULL;
1164         /* do not add SOA to reply message, it is going to be used internal */
1165         msg = val_neg_getmsg(env->neg_cache, &qinfo, region, env->rrset_cache,
1166                 env->scratch_buffer, *env->now, 0, topname, env->cfg);
1167         return msg;
1168 }